Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.1
Starto ThemeGoods: Attackers can inject malicious code on your website
CVE-2026-27352
Summary
The Starto ThemeGoods website plugin is vulnerable to a security issue that allows attackers to inject malicious code into your website. This can happen when a visitor clicks on a link or enters data into a form, and can potentially steal sensitive information or take control of your website. Update to version 2.2.0 or later to fix the issue.
Original title
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Starto starto allows Reflected XSS.This issue affects Starto: from n/a through <= 2....
Original description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Starto starto allows Reflected XSS.This issue affects Starto: from n/a through <= 2.1.9.
nvd CVSS3.1
7.1
Vulnerability type
CWE-79
Cross-site Scripting (XSS)
Published: 5 Mar 2026 · Updated: 13 Mar 2026 · First seen: 6 Mar 2026